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Amendments to the Claims 



This listing uf claims will replace all prior versions of claims in the appjicatiou: 
Listing of Claims: 

1 . (Currently Amended) A method of determining the location of an Internet host using a 
fest computer system, comprising: 

obtaining route information relating to first and s e cond a network path[[s]] between a 
host IP address associated with the Internet host and the feet computer system and a s e cond 
cornpu to r -^ yfltcm, r espeet*"e!y ? wherein the network p^h comprises the #F9t computer 
system, the Internet host, and rt le?st one intermediate network node, *he^eeex>&-ne^r~ 1 ~F -*H 
oomprises th e s e cond comput e r system, th e Intarnot hoot, and at l e ast another int e rm e di ate 
network nod e, and wherein the route information comprises a plurality of router labels associated 
with the host IP address and ono of the at least one intermediate network node and th e at L e ast 
another intorruodiato network nodo ; 

extracting a &st location code from the route information corresponding to a router label 
associated with one of the Internet host and an intermediate network node proximate the Internet 
host; 

consulting a data store comprising at least one data set having location codes and 
corresponding location information; 

obtaining feet location information from the data store corresponding to the fest location 
code associated with the one of the Internet host and the intermediate network node proximate 
the Internet host; aed 

providing a fest location estimate of the location of the Internet host according to the fijst 
location information from the data store corresponding to the fest location codei 
determining a delay time associated with the network path; and 
selectively correcting the location estimate according to the delay tim e associated with 
the network path . 
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2. (Currently Amended) The method of claim 1, further comprising[[:]] extracting the 
location code bv examining the router labels in route order alone the oath from the host to the 
computer system until a location code is found that is usable to obtain location infor mation from 
the data store. 

det e miining q d e lay time associat e d with at l e ast on e of th e first and s e cond network 
paths; br4 

s e l e ctiv e ly corr e cting th e first location e stimate according to the dolny times associated 
with tho at loaot ono of tho firot and Gooond network - paths - . 

3 . (Currently Amended) The method of claim 2, further comprising: 

determining c confidence metric repre<ort^*?ve of the accuracy of the Ioc^! ; or» 
estimat e: and acssrdi^g^e^the^^^time 

selectively providing the location estimate of the location of the Internet host if the 
confiden ce metric exceeds a threshold, 

4. (Currently Amended) The method of claim 3 [[I]], further comprising: 
determining a confidence metric representative of the accuracy of the &st location 

estimate based upon the delay time between the Internet host and the network node associated 
with the location estimatCr -and 

s e l e ctiv e ly providing th e first location e stimat e of th e location of th e Internet host if th e 
confidence metric e xcoodfi a thr e shold. 

5. (Currently Amended) The method of claim 1, further comprising: 

obtaining second route information relating to each th e s e cond network path between the 
host IP address and th e s e cond each of a plurality of computer systems^ wherein the se cond route 
information comprises a plurality of router labels associated with the host IP address , and each of 
the plurality of computer systems, and the at least one anoth e r intermediate network node in each 
network path ; 

extracting a oooond location code for each network path from the second route 
information corresponding to a seeead router label associated with one of the Internet host and 
the at least one anoth e r intermediate network nod e in each network path: 
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obtaining second location information from the data store corresponding to each fe e 
aooond location code; 

providing a s e cond plurality of location estimates of the location of the Intexuci ho&t 
according to the s econd location information from the data store corresponding to tho second 
each location code; and 

correlating at least two of t he firGt and ocoond location estimates to provide an improved 
location estimate of the location of the Internet host. 

6. (Original) The method of claim 1 , wherein the location code comprises one of a city 
code, and airport code, and a country code, and wherein obtaining the route information 

comprises using a trcv^ r o i ite tool. 

7. (Currently Amended) A software tool for determining the location of an Internet host 
using a first computer system, comprising: 

a route trace component adapted to obtain route information relating to first and s e cond a 
network path[[s]] between a host DP address associated with the Internet host and the fi*st 
computer system and a s e cond computer Gyotcro, respectively , wherein the first network path 
comprises the fi*st computer system, the Internet host, and at least one intermediate network 
node, th e s e cond network path compris e s the second computer oyotom, the Internet host, and at 
least another intermediate network nod e , and wherein the route information comprises a plurality 
of router labels associated with the host IP address and oae~ef the at least one intermediate 
network node and th e at l e ast another intermediate network nod e; 

an extraction component adapted to extract a &st location code from the route 
information corresponding to a router label associated with one of the Internet host and an 
intermediate network node proximate the Internet host; 

a data store comprising at least one data set having location codes and corresponding 
location information; and 

an estimation component adapted to obtain first location information from the data store 
corresponding to the fi*st location code associated with the one of the Internet host and the 
intermediate network node proximate the Internet host, and to provide a &st location estimate of 
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the location of the Internet host according to the &st location information from the data store 
corresponding to the first location code;. 

a cor rection component to determine a delay time associated with tbe network path and 
selectively correct the location estimate according to the delay time associated with the network 
path . 

8. (Currently Amended) A computer-readable medium having computer-executable 
instructions for: 

obtaining route information relating to first and s e cond a network path[[s) J between a 
host IP address associated with an Internet host and a fest computer system and-a s econd 
compnte r ry^e^^espe ctiv e ly, wherein thft §*s* network path comprises the fifst computer 
system, tbe Internet ho$t, and at least one intermediate network node, xhe-geeon d neb ^erk-psrh 
compriaca th e s e cond computer syst e m, th e Internet host, and at least anoth e r interm e diat e 
network nod e , and wherein the route information comprises a plurality of router labels associated 
with the host IP address and ene-^f the at least one intermediate network node and th e at least 
anoth e r intomiodiato - aotwork node ; 

extracting a first location code from the route information corresponding to a router label 
associated with one of the Internet host and an intermediate network node proximate the Internet 
host; 

consulting a data store comprising at least one data set having location codes and 
corresponding location information; 

obtaining first location information from the data store corresponding to the first location 
code associated with the one of the Internet host and the intermediate network node proximate 
the Internet host; aad 

providing a &st location estimate of the location of the Internet host according to the firs* 
location information from the data store corresponding to thefifst location code; 
determining a delay time associated with the network path: and 
selectively correcting the location estimate according to the delay time associated with 
flie network path . 
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9. (Currently Amended) A system for determining the location of an Internet host, 
comprising: 

a rirst component operating in a &&t computer system to obtain rouie irttbnnaaon 
relating to first and oooond a network path[[s]] between a host IP address associated with the 
Internet host and the first computer system and a second comput e r system, respectively , wherein 
the first network path comprises the &st computer system, the Internet host, and at least one 
intermediate network node, the second network path comprises the second computer 3y3tom > tho 
ffttcract host, and at Least another interm e diat e n e twork nod e > and wherein the route information 
comprises a plurality of router labels associated with the host IP address and en » of the at least 
one intermediate network node and tho at loast another intermediate network node ; 

a s^c^^u exponent operating in the fbjt computer system to z?:tzz~l w fi/^t- location code 
from the rotate iiifunnation corresponding to a router label associated with wu, of iho Internet 
host and an intermediate network node proximate the Internet host; 

a third component operating in the fee* computer system to consult a data store 
comprising at least one data set having location codes and corresponding location information; 

a fourth component operating in the fet computer system to obtain fest location 
information from the data stone corresponding to the fest location code associated with the one 
of the Internet host and the intermediate network node proximate the Internet host; &&4 

a fifth component operating in the fits* computer system to provide a fest location 
estimate of the location of the Internet host according to the &st location information from the 
data store corresponding to the fest location cod e; and 

a sixth component operating in the computer system to determine a delay time associated 
with the network path and selectively correct the location estimate according to the delay time 
associated with the network path . 

10. (Currently Amended) Geographical location estimate data associated with an Internet 
host, the estimate data resulting from a process executing on a computer system, comprising e£ 

obtaining route information relating to first and s e cond a network path[[s]] between a 
host IP address associated with the Internet host and a computer system and a s e cond 
comput e r syst e m > r e sp e ctiv e ly , wherein the first network path comprises the fest computer 
system, the Internet host, and at least one intermediate network node, tho oooond network path 
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compriooG tho oocond comput e r syst e m, th e Intern e t host; and at looat another intermediate 
network nodo, and wherein the route information comprises a plurality of router labels associated 
with the host IP address and efte-of the at least one intermediate network node m d - tko - ut least 
anothor intermediat e network nod e; 

extracting a £*st location code from the route information corresponding to a router label 
associated with one of the Internet host and an intermediate network node proximate the Internet 
host; 

consulting a data store comprising at least one data set having location codes and 
corresponding location information; 

obtaining &st location information from the data store corresponding to the &st location 

code associated with the one of the Internet host and the intermediate network no^c proximate 
the Internet host; and 

providing a fest location estimate of the location of the Internet host according to the fest 
location information from the data store corresponding to the first location code* 
determining a delay rime associat ed with the network path: and 
selectively correcting the location estimate according to the delay time associated with 
the network path . 

1 1 . (Currently Amended) A method of determining the location of an Internet host using 
multiple computer systems, comprising: 

obtaining route information relating to a plurality of network paths between a host IP 
address associated with the Internet host and a corresponding plurality of computer systems, 
respectively, wherein the plurality of network paths individually comprise a corresponding 
computer system, the Internet host, and at least one intermediate network node, and wherein the 
route information comprises a plurality of router labels associated with the host IP address and 
an intermediate network node; 

extracting a location code from the route information corresponding to a router label 
associated with one of the Internet host and an intermediate network node proximate the Internet 
host; 

consulting a data store comprising at least one data set having location codes and 
corresponding location information; 
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obtaining location information from the data store corresponding to the location code 
associated with the one of the Internet host and the intermediate network node proximate the 

InlemeL host; m*i 

providing a location estimate of the location of the Internet host according to the location 
information. 

determining a delay time associated with at least one of the network paths: and 
selectively correctin g the location estimate according to the delay time. 

12. (Original) A method of determining the location of an Internet host using a first computer 
system, comprising: 

rn^suring a first delay time ^Vtirs to a first network path between a host IP address 
associated with the Internet host and +v> %st computer system; 

measuring a second delay time relating to a second network path between the host IP 
address and a second computer system; 

measuring a third delay time relating to a third network path between the host IP address 
and a third computer system; 

correlating the first, second, and third delay times; and 

providing a location estimate of the location of the Internet host according to the 
correlation of the first, second, and third delay times. 

13. (Original) The method of claim 12, wherein correlating the first, second, and third delay 
times comprises triangulating the first, second, and third delay measurements. 

14. (Original) The method of claim 12, wherein correlating die first, second, and third delay 
times comprises: 

consulting a data store comprising N sets of first, second, and third delay measurements 
between the first, second, and third computer systems, respectively, and N known hosts, as well 
as location information associated with the N known hosts, wherein N is an integer, 

performing a comparison of the first, second, and third delay times with the N sets of 
first, second, and third delay measurements in the data store; 
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determining a nearest set of first, second, and third delay measurements according to the 
comparison; and 

providing a location estimate of eric Internet host according to the newest set of first, 
second, and third delay measurements. 

15. (Original) The method of claim 14, wherein performing the comparison of the first, 
second, and third delay times with the N sets of first, second, and third delay measurements in 
the data store comprises determining N Euclidian distances corresponding to the Euclidian 
distances between the N sets of first, second, and third delay measurements in the data store and 
the first, second, and third delay times, and wherein providing a location estimate of the Internet 
host according to the nearest set of frr*. s^^rA fTid third delay measi'T^rrc^ts corrprises 
selecting locrt^on information assec^t^d ^."t>> the sst of first, second, ?r»d tbvrtf *May 
measurements in the data store associated with the smallest Euclidian distance as the location 
estimate. 

1 6. (Original) The method of claim 1 2, 

wherein correlating the first, second, and third delay times comprises: 

computing a first probability density function establishing a relationship between a first 

network delay associated with the first computer system and a first distance from the first 

computer system; 

determining a first distance estimate representative of the distance between the first 
computer system and the location of the Internet host using the first delay time and the first 
probability density function; 

computing a second probability density function establishing a relationship between a 
second network delay associated with the second computer system and a second distance from 
the second computer system; 

determining a second distance estimate representative of the distance between the second 
computer system and the location of the Internet host using the second delay time and the second 
probability density function; 
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computing a third probability density function establishing a relationship between a third 
network delay associated with the third computer system and a third distance from the third 
compute* system; and 

determining a third distance estimate representative of the distance between the third 
computer system and the location of the Internet host using the third delay time and the third 
probability density function; 

and wherein providing the location estimate comprises triangulating the first, second, and 
third distance estimates. 

17. (Original) The method of claim 16, wherein determining the first, second, and third 

^istroce estimates further comprise?; computing an error function over a location space, and 
4 ^termining coordinates within th? location spree where the error function is minimized. 

1 8. (Original) The method of claim 17, wherein determining coordinates within the location 
space where the error function is minimized comprises minimizing the error function across a list 
of known city locations, and wherein providing the location estimate comprises providing the 
known city location corresponding with the minimum value of the error function. 

19. (Original) The method of claim 18, wherein computing the error function comprises 
using a weighted least mean squares algorithm to optimize the location estimate. 

20. (Original) The method of claim 18, wherein computing the error function comprises 
using a probability density estimation to optimize the location estimate. 

21. (Original) The method of claim 1 8, wherein computing the error function comprises 
using a weighted least mean squares algorithm to prune a solution space, and using a probability 
density estimation to optimize the location estimate from the pruned solution space. 

22. (Original) The method of claim 1 8, wherein computing the error function comprises 
using a probability density estimation to prune a solution space, and using a weighted least mean 
squares algorithm to optimize the location estimate from the pruned solution space. 
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23. (Original) A software tool for determining the location of an Internet host using a first 
computet system, comprising: 

a first delay component adapted to measure a first delay time relating to a first network 
path between a host IP address associated with the Internet host and the first computer system; 

a second delay component adapted to measure a second delay time relating to a second 
network path between the host IP address and a second computer system; 

a third delay component adapted to measure a third delay time relating to a third network 
path between the host IP address and a third computer system; 

a correlation component adapted to correlate the first, second, and third delay times; and 

?n estimation component id^ptrd to provide a location of the location of the 

Tritnrn^t brtst according to the ccm-e^tio^ *f the 5r$t, second, tr* 4 >"H ^clay times. 

24. (Original) A computer-readable medium having computer-executable instructions for 
measuring a first delay time relating to a first network path between a host IP address 

associated with the Internet host and the first computer system; 

measuring a second delay time relating to a second network path between the host DP 
address and a second computer system; 

measuring a third delay time relating to a third network path between the host IP address 
and a third computer system; 

correlating the first, second, and third delay times; and 

providing a location estimate of the location of the Internet host according to the 
correlation of the first, second, and third delay times. 

25. (Original) A system for determining the location of an Internet host, comprising: 

a first component operating in a first computer system to measure a first delay time 
relating to a first network path between a host IP address associated with the Internet host and 
the first computer system; 

a second component operating to measure a second delay time relating to a second 
network path between the host IP address and a second computer system; 
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a third component operating to measure a third delay time relating to a third network path 

between the host IP address and a third computer system; 

a fourth component operating to correlate the first, second, and third delay times; and 
a fifth component operating in a first computer system to provide a location estimate of 

the location of the Internet host according to the correlation of the first, second, and third delay 

times. 

26. (Currently Amended) Geographical location estimate data associated with an Internet 
host, the estimate data resulting from a process executing on a computer system comprising ef: 

measuring a first delay time relating to a first network path between a host IP address 

a^oooiaec <J with the Internet host and a fu^t computer system; 

measuring a second delay time relating io a second nctvvoi'k path bo^v^n the host IP 
address and a second computer system; 

measuring a third delay time relating to a third network path between the host IP address 
and a third computer system; 

correlating the first, second, and third delay times; and 

providing a location estimate of the location of the Internet host according to the 
correlation of the first, second, and third delay times. 

27. (Currently Amended) A method of determining the location of an Internet host using a 
first computer system, comprising: 

obtaining partial IP-to-location mapping information from a data source; 
obtaining network routing infonnation; 

clustering together IP addresses corresponding to hosts in the same geographic location 
according to network routing infonnation to obtain cluster information; 

correlating the partial IP-to-location information with the cluster informationj-aad 

providing a location estimate of the location of the Internet host according to the 
correlation of the partial IP-to-location information and the cluster informatio n; and 

computing a dispersion metric representative of the accuracy of the location estimate of 
the location of the Internet host 
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28. (Original) The method of claim 27, wherein obtaining network routing information 
comprises using a routing protocol* 

29. (Original) The method of claim 28, wherein the routing protocol is one of BGP, RIP, 
OSPF, IGRP, and EGP. 

30. (Original) The method of claim 27, wherein clustering together IP addresses 
corresponding to hosts in the same geographic location according to network routing information 
to obtain cluster information comprises associating an address prefix used by a routing protocol 
with a geographical location. 

3 1 . (Original) The method of claim 30, further comprising: 

sub-dividing the geographical location associated with the address prefix into at least two 
clusters according to a geographical spread associated with the geographical location. 

32. (Original) The method of claim 27, further comprising sub-dividing the cluster 
information according to a geographical spread associated with the geographical location. 

3 3 . (Currently Amended) The method of claim 27, further comprising computing a 
disp e rsion motrio repre s entative of the accuracy of th e location e stimat e of th e location of th e 
Intomot hoot selectively providing the location estimate if the dispersion metric is less than a 
threshold value. 

34. (Currently Amended) The method of claim 33, further comprising oolootivoly providing 
thn Innntinti nntimfito if tho diqiorflion metric is less than a thr e shold valu e a threshold value that 
is dependent on the size of the cluster . 

35. (Original) The method of claim 27, further comprising: 

obtaining route information relating to a first network path between a host IP address 
associated with the Internet host and the first computer system, wherein the first network path 
comprises the first computer system, the Internet host, and at least one intermediate network 
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node, and wherein the route information comprises a plurality of router labels associated with the 
host IP address and the at least one intermediate network node; 

extracting a first location code from the route information corresponding to a router label 
associated with one of the Internet host and an intermediate network node proximate the Internet 
host; 

consulting a data store comprising at least one data set having location codes and 
corresponding location information; 

obtaining first location information from the data store corresponding to the first location 
code associated with the one of the Internet host and the intermediate network node proximate 
the Internet host; and 

providing a first location estimate of the location of the Tstf-met host according to the first 
location information from the d?.t? store corresponding to th§ first location cede. 

36. (Original) The method of claim 35, further comprising: 

measuring a first delay time relating to a first network path between a host IP address 
associated with the Internet host and the first computer system; 

measuring a second delay time relating to a second network path between the host IP 
address and a second computer system; 

measuring a third delay time relating to a third network path between the host IP address 
and a third computer system; 

correlating the first, second, and third delay times; and 

providing a location estimate of the location of the Internet host according to the 
correlation of the first, second, and third delay times. 

37. (Original) The method of claim 27, further comprising: 

measuring a first delay time relating to a first network path between a host IP address 
associated with the Internet host and the first computer system; 

measuring a second delay time relating to a second network path between the host IP 
address and a second computer system; 

measuring a third delay time relating to a third network path between the host IP address 
and a third computer system; 
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correlating the first, second, and third delay times; and 

providing a location estimate of the location of the Internet host according to the 
correlation of the first, second, and third delay times. 

38. (Currently Amended) A software tool for determining the location of an Internet host 
using a first computer system, comprising: 

a first component adapted to obtain partial IP-to-location mapping information from a 
data source; 

a routing protocol component adapted to obtain network routing information; 

a clustering component adapted to cluster together IP addresses corresponding to hosts in 

the same geographic location according to network routing information to obtain cluster 
information; 

a correlation component adapted to correlate the partial IP-to-location information with 
the cluster information; -aad 

an estimation component adapted to provide a location estimate of the location of the 
Internet host according to the correlation of the partial IP-to-location information and the cluster 
informatio n: and 

a correction component to compute a dispersion metric representative of the accuracy of 
the location estimate of the location of the Internet host and selectively providing the location 
estimate . 

39. (Currently Amended) A computer-readable medium having computer-executable 
instructions for 

obtaining partial IP-to-location mapping information from a data source; 
obtaining network routing information; 

clustering together IP addresses corresponding to hosts in the same geographic location 
according to network routing information to obtain cluster information; 

correlating the partial IP-to-location information with the cluster information; and 

providing a location estimate of the location of the Internet host according to the 
correlation of the partial IP-to-location information and the cluster informatio n: and 
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calculating a dispersion metric representative of the accuracy of the location estimate of 
the location of the Internet host and selectively providing the location esti mate. 

40, (Currently Amended) A system for determining the location of an Internet host, 
comprising: 

a first component operating to obtain partial DP-to-Iocation mapping information from a 
data source; 

a second component operating to obtain network routing information; 

a third component operating to cluster together IP addresses corresponding to hosts in the 
same geographic location according to network routing information to obtain cluster 

information; 

a fourth component operating to correlate the partial IP-to-location information with + h£ 
cluster information; and 

a fifth component operating to provide a location estimate of the location of the Internet 
host according to the correlation of the partial DP-to-Iocation information and die cluster 
informatio n: and 

a sixth component operating to calculate a dispersion metric representative of the 
accuracy of the location estimate of the location of the Internet host and selectively providing the 
location estimate . 

41 . (Currently Amended) Geographical location estimate data associated with an Internet 
host, the estimate data resulting from a process executing on a computer system, comprising e£ 

obtaining partial IP-to-location mapping information from a data source; 
obtaining network routing information; 

clustering together IP addresses corresponding to hosts in the same geographic location 
according to network routing information to obtain cluster information; 

correlating the partial IP-to-location information with the cluster information; and 

providing a location estimate of the location of the Internet host according to the 
correlation of the partial IP-to-location information and the cluster informationiaod 

computing a dispersion metric representative of the accuracy of the location estimate of 
the location of the Internet host and selectively providing the location estimate . 
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